Overview

overview

10

Static

static

3

kuai.exe

windows10-2004-x64

10

Resubmissions

22-11-2024 05:20

241122-f1maes1ldp 10

19-11-2024 04:50

241119-fgjees1elr 10

Analysis

  • max time kernel
    167s
  • max time network
    168s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22-11-2024 05:20

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    kuai.exe

  • Size

    31.4MB

  • MD5

    bb1058c71041096a14109e59bdcb4e5f

  • SHA1

    0ad3510e1e0f1e01fdd645e114f8ce743b1aed1b

  • SHA256

    ac4e2d438500d0cd21f3fc269b37123dcd8c732bcf945b716b29643c411f4089

  • SHA512

    f25a6cd4b741f33f10f06fad324d93b48013ffcfcb850fa50971b1b76bde381007b8bf5b0b736569ac5661e49a3e8d54b308f8f09dfbc8540b9911ee71ded99b

  • SSDEEP

    393216:ysFBi0lwDQi8oo4zAQUi+9U8TEFzSVy6vbBYShIL6DNBjuy1K+HAfHiF3v:y+BBuEidD98TE8s6NzpS/Q

Score
10/10
discoveryevasionexecutionpersistenceprivilege_escalationtrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 3 IoCs
    evasiontrojan
  • Drops file in Drivers directory 3 IoCs
  • Modifies Windows Firewall 2 TTPs 5 IoCs
    evasion
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 64 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates connected drives 3 TTPs 22 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Network Service Discovery 1 TTPs 4 IoCs

    Attempt to gather information on host's network.

    discovery
  • Drops file in System32 directory 16 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 6 IoCs
  • Browser Information Discovery 1 TTPs

    Enumerate browser information.

    discovery
  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Using powershell.exe command.

    execution
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Event Triggered Execution: Netsh Helper DLL 1 TTPs 24 IoCs

    Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

    persistenceprivilege_escalation
  • System Location Discovery: System Language Discovery 1 TTPs 34 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 64 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 6 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 6 IoCs
  • Gathers network information 2 TTPs 4 IoCs

    Uses commandline utility to view network configuration.

  • Modifies data under HKEY_USERS 45 IoCs
  • Modifies registry class 3 IoCs
  • Modifies system certificate store 2 TTPs 11 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary 6 IoCs
  • Suspicious behavior: SetClipboardViewer 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 63 IoCs
  • Suspicious use of SendNotifyMessage 58 IoCs
  • Suspicious use of SetWindowsHookEx 23 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\kuai.exe
    "C:\Users\Admin\AppData\Local\Temp\kuai.exe"
    1⤵
    • Checks computer location settings
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:3212
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ipconfig /all
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1420
      • C:\Windows\system32\ipconfig.exe
        ipconfig /all
        3⤵
        • Gathers network information
        PID:2484
    • C:\Windows\System32\netsh.exe
      "C:\Windows\System32\netsh.exe" -f C:\ProgramData\7rAlL.xml
      2⤵
      • Event Triggered Execution: Netsh Helper DLL
      PID:976
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /C "C:\Users\Admin\AppData\Roaming\o9xM6.bat"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2356
      • C:\Windows\system32\reg.exe
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v ConsentPromptBehaviorAdmin /t reg_dword /d 0 /F
        3⤵
        • UAC bypass
        PID:1304
      • C:\Windows\system32\reg.exe
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t reg_dword /d 0 /F
        3⤵
        • UAC bypass
        PID:5076
      • C:\Windows\system32\reg.exe
        reg add HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v PromptOnSecureDesktop /t reg_dword /d 0 /F
        3⤵
        • UAC bypass
        PID:2740
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c copy /b C:\ProgramData\J56hS\188P7~16\s+C:\ProgramData\J56hS\188P7~16\a C:\ProgramData\J56hS\188P7~16\DuiLib.dll
      2⤵
        PID:1028
    • C:\Windows\system32\mmc.exe
      C:\Windows\system32\mmc.exe -Embedding
      1⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4432
      • C:\ProgramData\J56hS\188P7~16\WXWorkUpdate.exe
        "C:\ProgramData\J56hS\188P7~16\WXWorkUpdate.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Enumerates connected drives
        • System Location Discovery: System Language Discovery
        • Checks processor information in registry
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:808
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c ipconfig /all
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:1904
          • C:\Windows\SysWOW64\ipconfig.exe
            ipconfig /all
            4⤵
            • System Location Discovery: System Language Discovery
            • Gathers network information
            PID:2284
    • C:\Windows\system32\mmc.exe
      C:\Windows\system32\mmc.exe -Embedding
      1⤵
      • Suspicious behavior: SetClipboardViewer
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4292
      • C:\ProgramData\letsvpn-latest.exe
        "C:\ProgramData\letsvpn-latest.exe"
        2⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Drops file in Program Files directory
        • System Location Discovery: System Language Discovery
        • Suspicious use of SetWindowsHookEx
        • Suspicious use of WriteProcessMemory
        PID:3532
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell.exe -inputformat none -ExecutionPolicy Bypass -Command "If ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } Else { $env:PROCESSOR_ARCHITECTURE }"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2296
        • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
          powershell -inputformat none -ExecutionPolicy Bypass -File "C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1"
          3⤵
          • Command and Scripting Interpreter: PowerShell
          • System Location Discovery: System Language Discovery
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:244
        • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
          "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
          3⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of SetWindowsHookEx
          PID:4648
        • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
          "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" install "C:\Program Files (x86)\letsvpn\driver\OemVista.inf" tap0901
          3⤵
          • Executes dropped EXE
          • Drops file in System32 directory
          • Drops file in Windows directory
          • Checks SCSI registry key(s)
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of SetWindowsHookEx
          PID:1924
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=lets
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3880
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=lets
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4596
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=lets.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:2368
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=lets.exe
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:516
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=LetsPRO.exe
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:4588
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=LetsPRO.exe
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:4328
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=LetsPRO
          3⤵
          • System Location Discovery: System Language Discovery
          • Suspicious use of WriteProcessMemory
          PID:3276
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=LetsPRO
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:2108
        • C:\Windows\SysWOW64\cmd.exe
          cmd /c netsh advfirewall firewall Delete rule name=LetsVPN
          3⤵
          • System Location Discovery: System Language Discovery
          PID:3120
          • C:\Windows\SysWOW64\netsh.exe
            netsh advfirewall firewall Delete rule name=LetsVPN
            4⤵
            • Modifies Windows Firewall
            • Event Triggered Execution: Netsh Helper DLL
            • System Location Discovery: System Language Discovery
            PID:848
        • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
          "C:\Program Files (x86)\letsvpn\driver\tapinstall.exe" findall tap0901
          3⤵
          • Executes dropped EXE
          • Checks SCSI registry key(s)
          • Suspicious use of SetWindowsHookEx
          PID:3552
        • C:\Program Files (x86)\letsvpn\LetsPRO.exe
          "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
          3⤵
          • Executes dropped EXE
          • System Location Discovery: System Language Discovery
          • Suspicious use of SetWindowsHookEx
          PID:1300
          • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe
            "C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe"
            4⤵
            • Executes dropped EXE
            • Loads dropped DLL
            • Adds Run key to start application
            • Drops file in Program Files directory
            • System Location Discovery: System Language Discovery
            • Checks processor information in registry
            • Modifies registry class
            • Modifies system certificate store
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of FindShellTrayWindow
            • Suspicious use of SendNotifyMessage
            PID:2220
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C ipconfig /all
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4404
              • C:\Windows\SysWOW64\ipconfig.exe
                ipconfig /all
                6⤵
                • System Location Discovery: System Language Discovery
                • Gathers network information
                PID:3564
            • C:\Windows\SysWOW64\netsh.exe
              C:\Windows\System32\netsh interface ipv4 set dnsservers \"LetsTAP\" source=dhcp validate=no
              5⤵
              • Event Triggered Execution: Netsh Helper DLL
              • System Location Discovery: System Language Discovery
              PID:4392
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C route print
              5⤵
              • System Location Discovery: System Language Discovery
              PID:4328
              • C:\Windows\SysWOW64\ROUTE.EXE
                route print
                6⤵
                • System Location Discovery: System Language Discovery
                PID:5016
            • C:\Windows\SysWOW64\cmd.exe
              "cmd.exe" /C arp -a
              5⤵
              • Network Service Discovery
              • System Location Discovery: System Language Discovery
              PID:3884
              • C:\Windows\SysWOW64\ARP.EXE
                arp -a
                6⤵
                • Network Service Discovery
                • System Location Discovery: System Language Discovery
                PID:2060
    • C:\Windows\system32\svchost.exe
      C:\Windows\system32\svchost.exe -k DcomLaunch -p -s DeviceInstall
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2952
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "4" "0" "C:\Users\Admin\AppData\Local\Temp\{03114f9c-f977-9442-b1f4-64a01169cfe2}\oemvista.inf" "9" "4d14a44ff" "000000000000014C" "WinSta0\Default" "000000000000015C" "208" "c:\program files (x86)\letsvpn\driver"
        2⤵
        • Drops file in System32 directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Modifies data under HKEY_USERS
        PID:3400
      • C:\Windows\system32\DrvInst.exe
        DrvInst.exe "2" "211" "ROOT\NET\0000" "C:\Windows\INF\oem3.inf" "oem3.inf:3beb73aff103cc24:tap0901.ndi:9.24.6.601:tap0901," "4d14a44ff" "000000000000014C"
        2⤵
        • Drops file in Drivers directory
        • Drops file in Windows directory
        • Checks SCSI registry key(s)
        • Suspicious use of AdjustPrivilegeToken
        PID:1720
    • C:\Windows\System32\svchost.exe
      C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted -p -s Netman
      1⤵
      • Modifies data under HKEY_USERS
      PID:232
    • C:\Windows\system32\wbem\WmiApSrv.exe
      C:\Windows\system32\wbem\WmiApSrv.exe
      1⤵
        PID:1120
      • C:\Windows\system32\OpenWith.exe
        C:\Windows\system32\OpenWith.exe -Embedding
        1⤵
        • Modifies registry class
        • Suspicious use of SetWindowsHookEx
        PID:1176
        • C:\Program Files\Google\Chrome\Application\chrome.exe
          "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument mailto:[email protected]?subject=I have a question and need help&body=
          2⤵
          • Enumerates system info in registry
          • Modifies data under HKEY_USERS
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SendNotifyMessage
          PID:1588
          • C:\Program Files\Google\Chrome\Application\chrome.exe
            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdb96fcc40,0x7ffdb96fcc4c,0x7ffdb96fcc58
            3⤵
              PID:2464
            • C:\Program Files\Google\Chrome\Application\chrome.exe
              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1916,i,3053629939879964698,5106813841091041267,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=1912 /prefetch:2
              3⤵
                PID:776
              • C:\Program Files\Google\Chrome\Application\chrome.exe
                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=2084,i,3053629939879964698,5106813841091041267,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2120 /prefetch:3
                3⤵
                  PID:4560
                • C:\Program Files\Google\Chrome\Application\chrome.exe
                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2180,i,3053629939879964698,5106813841091041267,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=2636 /prefetch:8
                  3⤵
                    PID:2444
                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3124,i,3053629939879964698,5106813841091041267,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3144 /prefetch:1
                    3⤵
                      PID:2300
                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3188,i,3053629939879964698,5106813841091041267,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=3172 /prefetch:1
                      3⤵
                        PID:1500
                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4548,i,3053629939879964698,5106813841091041267,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4532 /prefetch:1
                        3⤵
                          PID:4228
                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4832,i,3053629939879964698,5106813841091041267,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=4840 /prefetch:8
                          3⤵
                            PID:4404
                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=4984,i,3053629939879964698,5106813841091041267,262144 --variations-seed-version=20241006-180150.222000 --mojo-platform-channel-handle=5072 /prefetch:8
                            3⤵
                              PID:4824
                        • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                          "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                          1⤵
                            PID:4648
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s NgcSvc
                            1⤵
                              PID:1604
                            • C:\Program Files (x86)\letsvpn\LetsPRO.exe
                              "C:\Program Files (x86)\letsvpn\LetsPRO.exe"
                              1⤵
                              • Executes dropped EXE
                              • System Location Discovery: System Language Discovery
                              PID:1372
                              • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe
                                "C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe"
                                2⤵
                                • Executes dropped EXE
                                • Drops file in Program Files directory
                                • System Location Discovery: System Language Discovery
                                • Checks processor information in registry
                                • Modifies system certificate store
                                • Suspicious behavior: EnumeratesProcesses
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious use of FindShellTrayWindow
                                • Suspicious use of SendNotifyMessage
                                PID:5000
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /C ipconfig /all
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:3564
                                  • C:\Windows\SysWOW64\ipconfig.exe
                                    ipconfig /all
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    • Gathers network information
                                    PID:2620
                                • C:\Windows\SysWOW64\netsh.exe
                                  C:\Windows\System32\netsh interface ipv4 set dnsservers \"LetsTAP\" source=dhcp validate=no
                                  3⤵
                                  • Event Triggered Execution: Netsh Helper DLL
                                  • System Location Discovery: System Language Discovery
                                  PID:4464
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /C route print
                                  3⤵
                                  • System Location Discovery: System Language Discovery
                                  PID:1056
                                  • C:\Windows\SysWOW64\ROUTE.EXE
                                    route print
                                    4⤵
                                    • System Location Discovery: System Language Discovery
                                    PID:3640
                                • C:\Windows\SysWOW64\cmd.exe
                                  "cmd.exe" /C arp -a
                                  3⤵
                                  • Network Service Discovery
                                  • System Location Discovery: System Language Discovery
                                  PID:1680
                                  • C:\Windows\SysWOW64\ARP.EXE
                                    arp -a
                                    4⤵
                                    • Network Service Discovery
                                    • System Location Discovery: System Language Discovery
                                    PID:4708
                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --single-argument mailto:[email protected]?subject=I have a question and need help&body=
                                  3⤵
                                  • Enumerates system info in registry
                                  • Modifies data under HKEY_USERS
                                  • Suspicious behavior: NtCreateUserProcessBlockNonMicrosoftBinary
                                  • Suspicious use of FindShellTrayWindow
                                  • Suspicious use of SendNotifyMessage
                                  PID:512
                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=crashpad-handler "--user-data-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" /prefetch:4 --monitor-self-annotation=ptype=crashpad-handler "--database=C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad" "--metrics-dir=C:\Users\Admin\AppData\Local\Google\Chrome\User Data" --url=https://clients2.google.com/cr/report --annotation=channel= --annotation=plat=Win64 --annotation=prod=Chrome --annotation=ver=123.0.6312.123 --initial-client-data=0x118,0x11c,0x120,0xf4,0x124,0x7ffdb96fcc40,0x7ffdb96fcc4c,0x7ffdb96fcc58
                                    4⤵
                                      PID:4328
                                    • C:\Program Files\Google\Chrome\Application\chrome.exe
                                      "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=gpu-process --no-appcompat-clear --gpu-preferences=WAAAAAAAAADgAAAMAAAAAAAAAAAAAAAAAABgAAEAAAA4AAAAAAAAAAAAAAAEAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAGAAAAAAAAAAYAAAAAAAAAAgAAAAAAAAACAAAAAAAAAAIAAAAAAAAAA== --field-trial-handle=1940,i,11108353572896551230,534211533246447636,262144 --variations-seed-version=20241121-050119.595000 --mojo-platform-channel-handle=1960 /prefetch:2
                                      4⤵
                                        PID:4976
                                      • C:\Program Files\Google\Chrome\Application\chrome.exe
                                        "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=1848,i,11108353572896551230,534211533246447636,262144 --variations-seed-version=20241121-050119.595000 --mojo-platform-channel-handle=2240 /prefetch:3
                                        4⤵
                                          PID:2300
                                        • C:\Program Files\Google\Chrome\Application\chrome.exe
                                          "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=storage.mojom.StorageService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=2296,i,11108353572896551230,534211533246447636,262144 --variations-seed-version=20241121-050119.595000 --mojo-platform-channel-handle=2668 /prefetch:8
                                          4⤵
                                            PID:1412
                                          • C:\Program Files\Google\Chrome\Application\chrome.exe
                                            "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=6 --field-trial-handle=3140,i,11108353572896551230,534211533246447636,262144 --variations-seed-version=20241121-050119.595000 --mojo-platform-channel-handle=3160 /prefetch:1
                                            4⤵
                                              PID:1764
                                            • C:\Program Files\Google\Chrome\Application\chrome.exe
                                              "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=5 --field-trial-handle=3180,i,11108353572896551230,534211533246447636,262144 --variations-seed-version=20241121-050119.595000 --mojo-platform-channel-handle=3312 /prefetch:1
                                              4⤵
                                                PID:2792
                                              • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=renderer --no-appcompat-clear --lang=en-US --device-scale-factor=1 --num-raster-threads=4 --enable-main-frame-before-activation --renderer-client-id=7 --field-trial-handle=4492,i,11108353572896551230,534211533246447636,262144 --variations-seed-version=20241121-050119.595000 --mojo-platform-channel-handle=4488 /prefetch:1
                                                4⤵
                                                  PID:3096
                                                • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                  "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=chrome.mojom.ProcessorMetrics --lang=en-US --service-sandbox-type=none --no-appcompat-clear --field-trial-handle=4844,i,11108353572896551230,534211533246447636,262144 --variations-seed-version=20241121-050119.595000 --mojo-platform-channel-handle=4856 /prefetch:8
                                                  4⤵
                                                    PID:4840
                                                  • C:\Program Files\Google\Chrome\Application\chrome.exe
                                                    "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=data_decoder.mojom.DataDecoderService --lang=en-US --service-sandbox-type=service --no-appcompat-clear --field-trial-handle=5076,i,11108353572896551230,534211533246447636,262144 --variations-seed-version=20241121-050119.595000 --mojo-platform-channel-handle=5092 /prefetch:8
                                                    4⤵
                                                      PID:2700
                                              • C:\Windows\system32\wbem\WmiApSrv.exe
                                                C:\Windows\system32\wbem\WmiApSrv.exe
                                                1⤵
                                                  PID:4364
                                                • C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe
                                                  "C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe"
                                                  1⤵
                                                    PID:804

                                                  Network

                                                  MITRE ATT&CK Enterprise v15

                                                  Reconnaissance

                                                  Resource Development

                                                  Initial Access

                                                  Execution

                                                  Command and Scripting Interpreter

                                                  2
                                                  T1059

                                                  PowerShell

                                                  1
                                                  T1059.001

                                                  Persistence

                                                  Boot or Logon Autostart Execution

                                                  1
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1547.001

                                                  Create or Modify System Process

                                                  1
                                                  T1543

                                                  Windows Service

                                                  1
                                                  T1543.003

                                                  Event Triggered Execution

                                                  1
                                                  T1546

                                                  Netsh Helper DLL

                                                  1
                                                  T1546.007

                                                  Privilege Escalation

                                                  Abuse Elevation Control Mechanism

                                                  1
                                                  T1548

                                                  Bypass User Account Control

                                                  1
                                                  T1548.002

                                                  Boot or Logon Autostart Execution

                                                  1
                                                  T1547

                                                  Registry Run Keys / Startup Folder

                                                  1
                                                  T1547.001

                                                  Create or Modify System Process

                                                  1
                                                  T1543

                                                  Windows Service

                                                  1
                                                  T1543.003

                                                  Event Triggered Execution

                                                  1
                                                  T1546

                                                  Netsh Helper DLL

                                                  1
                                                  T1546.007

                                                  Defense Evasion

                                                  Abuse Elevation Control Mechanism

                                                  1
                                                  T1548

                                                  Bypass User Account Control

                                                  1
                                                  T1548.002

                                                  Impair Defenses

                                                  2
                                                  T1562

                                                  Disable or Modify System Firewall

                                                  1
                                                  T1562.004

                                                  Disable or Modify Tools

                                                  1
                                                  T1562.001

                                                  Modify Registry

                                                  3
                                                  T1112

                                                  Subvert Trust Controls

                                                  1
                                                  T1553

                                                  Install Root Certificate

                                                  1
                                                  T1553.004

                                                  Credential Access

                                                  Discovery

                                                  Browser Information Discovery

                                                  1
                                                  T1217

                                                  Network Service Discovery

                                                  1
                                                  T1046

                                                  Peripheral Device Discovery

                                                  2
                                                  T1120

                                                  Query Registry

                                                  6
                                                  T1012

                                                  System Information Discovery

                                                  7
                                                  T1082

                                                  System Location Discovery

                                                  1
                                                  T1614

                                                  System Language Discovery

                                                  1
                                                  T1614.001

                                                  Lateral Movement

                                                  Collection

                                                  Command and Control

                                                  Exfiltration

                                                  Impact

                                                  Replay Monitor

                                                  Loading Replay Monitor...

                                                  Downloads

                                                  • C:\Program Files (x86)\letsvpn\AddWindowsSecurityExclusion.ps1
                                                    Filesize

                                                    318B

                                                    MD5

                                                    b34636a4e04de02d079ba7325e7565f0

                                                    SHA1

                                                    f32c1211eac22409bb195415cb5a8063431f75cd

                                                    SHA256

                                                    a9901397d39c0fc74adfdb95dd5f95c3a14def3f9d58ef44ab45fc74a56d46df

                                                    SHA512

                                                    6eb3255e3c89e2894f0085095fb5f6ab97349f0ed63c267820c82916f43a0ac014a94f98c186ff5d54806469a00c3c700a34d26de90afb090b80ac824a05aa2f

                                                    Download Submit

                                                  • C:\Program Files (x86)\letsvpn\LetsPRO.exe
                                                    Filesize

                                                    240KB

                                                    MD5

                                                    bd8643e5db648810348aa0755e455b70

                                                    SHA1

                                                    119cb1fb3057d9759d0abb3dfdafc460456c1cc4

                                                    SHA256

                                                    bec6a116ea2224dd1532c6eaf20e4d61199240e55ccd0270199fbd22f2806477

                                                    SHA512

                                                    b8033d8989c66431e1771ffc6d2549a4d1e32b8612b7331e7a2931ddad3e31c8a7e1af8ef129883034b1fcf466b8ad0e1cab431cbf5c20c724f4eef53468f714

                                                    Download Submit

                                                  • C:\Program Files (x86)\letsvpn\app-3.11.2\CommunityToolkit.Mvvm.dll
                                                    Filesize

                                                    109KB

                                                    MD5

                                                    143351606a574d84328219a7c18c7219

                                                    SHA1

                                                    8e47c7b530f40553f4a88daff11d78255cc77730

                                                    SHA256

                                                    cbe3b5714c52ad9ff8885d9893c9ed77ad54485a7c5bae3a75151c06d3ae7c4f

                                                    SHA512

                                                    b4698855a37639cac6dd4c400d11028bba1433f43e811e23881a72f7875048c77cf0dbd8bab8c0374ae7182fe41f37f69f5942d770fbbead86b12805b6647291

                                                    Download Submit

                                                  • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe
                                                    Filesize

                                                    1.5MB

                                                    MD5

                                                    ca72f8ead2ae568acc481f685385fb60

                                                    SHA1

                                                    887a1d53c8b61c81a80592ff62cf9cdf56b29d18

                                                    SHA256

                                                    d287af28a137d9c015531eae28815d2b0d0a53879318f104ef34e5d86e2c4618

                                                    SHA512

                                                    8da648e1363d490d6a4ee5ec9e38aec86384f345ae5fd58150b2affce8c3c208e1a55598cfe820d00e9448910598ffde29d2824275ebaafaa7d33279898a2e4c

                                                    Download Submit

                                                  • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsPRO.exe.config
                                                    Filesize

                                                    26KB

                                                    MD5

                                                    6126a1ab971d6bd4761f45791af90b1e

                                                    SHA1

                                                    36013821807f6fe08fe3b60a22ec519fd3e5579c

                                                    SHA256

                                                    9b7b7ec30f305b3cd9da40662f95ed57ae89ed8afd2b11d26503e387ff3c262d

                                                    SHA512

                                                    9f74f9f4ad593980337099717ba1e6b584530ee0e192b137297961d1550a70ae3a30fc1bf3e6e670fb817682354648d610f2a542b753a61f397ccaca20908510

                                                    Download Submit

                                                  • C:\Program Files (x86)\letsvpn\app-3.11.2\LetsVPNDomainModel.dll
                                                    Filesize

                                                    20KB

                                                    MD5

                                                    85bee1626071af1b07e79fc7963731e4

                                                    SHA1

                                                    d804e63940798891928f3ba29be85cf06fbb9769

                                                    SHA256

                                                    222f84cd3111f90b7ce045119e63678ee180ab0a7c4f48cae25f097ee425debe

                                                    SHA512

                                                    6649931736a607dceea5ec8180e07c14c331761a7dd0fa5ab4187d3302c0a51262ccce40024d6540f3453d8bdd43785c5f8d45e9c5252e097b69b30fced78832

                                                    Download Submit

                                                  • C:\Program Files (x86)\letsvpn\app-3.11.2\Newtonsoft.Json.dll
                                                    Filesize

                                                    693KB

                                                    MD5

                                                    33a3c1df70cfab1888a4b20565515f81

                                                    SHA1

                                                    c1bfab7454dda45074a6e2b9ae4e9a2712830af6

                                                    SHA256

                                                    0c3c293507c487b76021baaded76defb0fecaf01c1327a448a9b756987595a9e

                                                    SHA512

                                                    76d3e0c34c5e793283910f93af3693355abdd374cf50234496cf3bbebf82a381113fbb4d53ad469f2f5a001b2cb96c761310a3825f8973ae61a4e8b59061cb28

                                                    Download Submit

                                                  • C:\Program Files (x86)\letsvpn\app-3.11.2\System.Runtime.InteropServices.RuntimeInformation.dll
                                                    Filesize

                                                    21KB

                                                    MD5

                                                    2a27f887342305cecd5ba36c8dbd4267

                                                    SHA1

                                                    2ca43487e37a67824b071d2870765f26c33ef7f2

                                                    SHA256

                                                    26a04bc90979886d477bb9777545e75a65c5f67443fdb5185c2fea249afc882b

                                                    SHA512

                                                    8d25ed902e2ca4191118b75cae0ea6338d0ce6aac3d10c08288e802704a115b15988a764899f3368aca0e7798933c5d4925721d82d7a7228372f435a36e1eafe

                                                    Download Submit

                                                  • C:\Program Files (x86)\letsvpn\app-3.11.2\Utils.dll
                                                    Filesize

                                                    126KB

                                                    MD5

                                                    8af72dc9783c52125e229f8b79afba94

                                                    SHA1

                                                    71178bc7cfced6bc5dcb45ed666cdbe2c55182dd

                                                    SHA256

                                                    68ae722154cebfb3a3ca59b135e182a68fa0d6966a089008028f97022849bbc5

                                                    SHA512

                                                    dcada700522b78fe0006e84c6599a9857269512eb65a68c0475635f76d5805c43decad74232eb39dae83f987b3dabafe07129d44cce950c8dc9efd11901599e2

                                                    Download Submit

                                                  • C:\Program Files (x86)\letsvpn\app-3.11.2\log4net.config
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    7a7521bc7f838610905ce0286324ce39

                                                    SHA1

                                                    8ab90dd0c4b6edb79a6af2233340d0f59e9ac195

                                                    SHA256

                                                    2a322178557c88cc3c608101e8fc84bfd2f8fa9b81483a443bb3d09779de218d

                                                    SHA512

                                                    b25dfdce0977eaf7159df5eabe4b147a6c0adac39c84d1c7a9fe748446a10c8d2e20d04cf36221057aa210633df65f2a460821c8c79a2db16c912ec53a714d83

                                                    Download Submit

                                                  • C:\Program Files (x86)\letsvpn\app-3.11.2\log4net.dll
                                                    Filesize

                                                    273KB

                                                    MD5

                                                    5b9a663d7584d8e605b0c39031ec485a

                                                    SHA1

                                                    b7d86ebe4e18cb6d2a48a1c97ac6f7e39c8a9b91

                                                    SHA256

                                                    e45afce6eff080d568e3e059498f5768585143336c600011273366905f4fc635

                                                    SHA512

                                                    b02bd950384cf3d656c4b8f590013392e3028c6183aa9321bd91b6fc1f5d41b03771313ca5e3305398a60642fa14fc5a98daf3e6decba586c80861bafcbf0c64

                                                    Download Submit

                                                  • C:\Program Files (x86)\letsvpn\driver\OemVista.inf
                                                    Filesize

                                                    7KB

                                                    MD5

                                                    26009f092ba352c1a64322268b47e0e3

                                                    SHA1

                                                    e1b2220cd8dcaef6f7411a527705bd90a5922099

                                                    SHA256

                                                    150ef8eb07532146f833dc020c02238161043260b8a565c3cfcb2365bad980d9

                                                    SHA512

                                                    c18111982ca233a7fc5d1e893f9bd8a3ed739756a47651e0638debb0704066af6b25942c7961cdeedf953a206eb159fe50e0e10055c40b68eb0d22f6064bb363

                                                    Download Submit

                                                  • C:\Program Files (x86)\letsvpn\driver\tapinstall.exe
                                                    Filesize

                                                    99KB

                                                    MD5

                                                    1e3cf83b17891aee98c3e30012f0b034

                                                    SHA1

                                                    824f299e8efd95beca7dd531a1067bfd5f03b646

                                                    SHA256

                                                    9f45a39015774eeaa2a6218793edc8e6273eb9f764f3aedee5cf9e9ccacdb53f

                                                    SHA512

                                                    fa5cf687eefd7a85b60c32542f5cb3186e1e835c01063681204b195542105e8718da2f42f3e1f84df6b0d49d7eebad6cb9855666301e9a1c5573455e25138a8b

                                                    Download Submit

                                                  • C:\ProgramData\J56hS\188P7~16\DuiLib.dll
                                                    Filesize

                                                    2.3MB

                                                    MD5

                                                    3fe2756032dd2b102b5aedc719b46d10

                                                    SHA1

                                                    1b8d2b21350f9bfe270b12d77a9f793f5eecead2

                                                    SHA256

                                                    03c2632bc7ae92e409c063e4f260b1a7199ff6cdd7ba0b0455fd1947afe79b99

                                                    SHA512

                                                    800c62ea9d22c3d044de0497775b4f9a72a360ee0e4c222e267453b7d9cf7f90754689988c684aabdcffa8f245e9e9a48a2616f22a5cccfb11e06ad70b3160ae

                                                    Download Submit

                                                  • C:\ProgramData\J56hS\188P7~16\SK.txt
                                                    Filesize

                                                    204KB

                                                    MD5

                                                    108f9300c28d82bcd7cedc8769e91be6

                                                    SHA1

                                                    bbd6ab51e82887e8c8b0cf1a9e55a84078075100

                                                    SHA256

                                                    e7220fe3d5e1eb97584f88e0d25af27a018d748100b3f840c697b71c1037b238

                                                    SHA512

                                                    bb7f7d6a483cb01cf69895eba967d2a3b10d4af430c1d2ff0c16f5d3194a279fe525bf344d964d44c1c16ff9df79ffcee1d4ebf28f838909eccf948dc5d70703

                                                    Download Submit

                                                  • C:\ProgramData\J56hS\188P7~16\WXWorkUpdate.exe
                                                    Filesize

                                                    1.2MB

                                                    MD5

                                                    919845c9609f79ce1927249ec6d541c2

                                                    SHA1

                                                    f7fb946e5895ec3aecdd25e5403ea10374744bc0

                                                    SHA256

                                                    9843402d481a895f2f43601e2bf7164eb5589f583f9b58978c61677eb17e0990

                                                    SHA512

                                                    c612f0507790fca918eab7e34817a51ae3bc935a15b200b659c1cc8aeaf9c97cfbc1203d921fe38eedc402c3b1d8f88998f8f39dbf25e845139738d50a945092

                                                    Download Submit

                                                  • C:\ProgramData\J56hS\188P7~16\a
                                                    Filesize

                                                    1.2MB

                                                    MD5

                                                    2e9d70be56fa937fbc8d342997a3813b

                                                    SHA1

                                                    3adce5be09b0924ba7f4e02444c9f19027e0eca3

                                                    SHA256

                                                    7388e270cc163022c540650f08823825be0076a0b25b0e7bc4bdc6319e28cf79

                                                    SHA512

                                                    7c562d88c62f5a4cbf7ba0351e5793b6363439e626e922d81145334a3523eb371f68f9d0ee117e12f055e39d09267442233a735b2a8768bbf5de048c952567d8

                                                    Download Submit

                                                  • C:\ProgramData\J56hS\188P7~16\msvcp140.dll
                                                    Filesize

                                                    429KB

                                                    MD5

                                                    cfbdf284c12056347e6773cb3949fbba

                                                    SHA1

                                                    ad3fa5fbbc4296d4a901ea94460762faf3d6a2b8

                                                    SHA256

                                                    bbecdfda2551b01aa16005c88305982c360a9fb9ba3d9be2fb15f2e9c6eb809f

                                                    SHA512

                                                    2f24eac94d51f8f28c8e6b6234ca2e481e0f8f1a73df62766ff4f5640480377fb2c4a469babedb87d303503994b469e570aaf725e16da6f9b2d6a77f15b4623f

                                                    Download Submit

                                                  • C:\ProgramData\J56hS\188P7~16\s
                                                    Filesize

                                                    1.2MB

                                                    MD5

                                                    25e6c245c0b2d8f895be134bd54390d1

                                                    SHA1

                                                    41096adbc64cb7b310f7534dda521b5dec86d994

                                                    SHA256

                                                    0ce06d64d518f0df305711964a2adf8e24eb234ec1c8a2cab6f37c2a04d147bd

                                                    SHA512

                                                    36df8e9877b2cdab0a5dead00fc47cb0a1d3aee44f35424d0f8e776c3d38f9251b36ebee0444989089ba22eab52d2744f2863fcecce0e3469aee79040da3b55b

                                                    Download Submit

                                                  • C:\ProgramData\J56hS\188P7~16\vcruntime140.dll
                                                    Filesize

                                                    81KB

                                                    MD5

                                                    8e65e033799eb9fd46bc5c184e7d1b85

                                                    SHA1

                                                    e1cc5313be1f7df4c43697f8f701305585fe4e71

                                                    SHA256

                                                    be38a38e22128af9a529af33d1f02dd24b2a344d29175939e229cf3a280673e4

                                                    SHA512

                                                    e0207fe2c327e7a66c42f23b3cbabc771d3819275dc970a9fa82d7af5f26606685644b8ea511f87ec511eb3a086a9506adec96c01c1b80b788c253bd0d459fbd

                                                    Download Submit

                                                  • C:\ProgramData\letsvpn-latest.exe
                                                    Filesize

                                                    14.7MB

                                                    MD5

                                                    e039e221b48fc7c02517d127e158b89f

                                                    SHA1

                                                    79eed88061472ae590616556f31576ca13bfc7fb

                                                    SHA256

                                                    dc30e5dab15392627d30a506f6304030c581fc00716703fc31add10ff263d70b

                                                    SHA512

                                                    87231c025bb94771e89a639c9cb1528763f096059f8806227b8ab45a8f1ea5cd3d94fdc91cb20dd140b91a14904653517f7b6673a142a864a58a2726d14ae4b8

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Crashpad\settings.dat
                                                    Filesize

                                                    40B

                                                    MD5

                                                    db9149f34c6cfa44d2668a52f26b5b7f

                                                    SHA1

                                                    f8cd86ce3eed8a75ff72c1e96e815a9031856ae7

                                                    SHA256

                                                    632789cdfa972eec9efe17d8e2981c0298cf6bd5a7e5dad3cbdcf7bb30f2e47f

                                                    SHA512

                                                    169b56304747417e0afe6263dd16415d3a64fff1b5318cd4a919005abe49ca213537e85a2f2d2291ea9dc9a48ea31c001e8e09e24f25304ae3c2cfefad715ce9

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\BrowsingTopicsState
                                                    Filesize

                                                    649B

                                                    MD5

                                                    348608e73de44916fc9ccf46a81dafad

                                                    SHA1

                                                    a6150ca8856398ae99f921f2b13f472642a36e7b

                                                    SHA256

                                                    3c5aca8a183a2e7033b8ceb1fb3660f26464eb71b04d6d0550daac0e04bbc2cb

                                                    SHA512

                                                    a63a1c299387ddbffafef98d8e9af7d3e2be5bb43a4bc58fe67140f1741b4ea118248057255a22f853c9213a56aaeff89e8f9f3eec6ec9629371f77b198524c0

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\Network Persistent State
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    257c95888cd0a02f345510d71ced26f1

                                                    SHA1

                                                    b821ab9da5f042c64c2cc841c670036e903a0131

                                                    SHA256

                                                    1da0b433df0c65f70dfcdd8f850eb2fe609ba08bc893236e602478fc0ea1a8b9

                                                    SHA512

                                                    d84774bdee0f87eb8936ee534343d3f55618b11cb187ad3bede64c756e253958c5b74c9ef1cd50b778e4f69881936a8d0bceaab52b080312b7213f348d149765

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\SCT Auditing Pending Reports
                                                    Filesize

                                                    2B

                                                    MD5

                                                    d751713988987e9331980363e24189ce

                                                    SHA1

                                                    97d170e1550eee4afc0af065b78cda302a97674c

                                                    SHA256

                                                    4f53cda18c2baa0c0354bb5f9a3ecbe5ed12ab4d8e11ba873c2f11161202b945

                                                    SHA512

                                                    b25b294cb4deb69ea00a4c3cf3113904801b6015e5956bd019a8570b1fe1d6040e944ef3cdee16d0a46503ca6e659a25f21cf9ceddc13f352a3c98138c15d6af

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Network\TransportSecurity
                                                    Filesize

                                                    356B

                                                    MD5

                                                    b4fdc17d95d43395fb9ff43d5f347f11

                                                    SHA1

                                                    e93000e6b0da2f1daf311fe989e043690719a90d

                                                    SHA256

                                                    95d0b246862a9c1b13621eaf4e978ab164f880a256dcde5403ff8e2018f79253

                                                    SHA512

                                                    957c16e75d5831a9e02aa2ab67851b8f316035827f504e9aff81b981d3d608769672415ca90d70a3f873d1373a7752b323b384e320939501a32da33bd3ce69fa

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Preferences
                                                    Filesize

                                                    9KB

                                                    MD5

                                                    65b10c20241e5c7639a97ced441c6817

                                                    SHA1

                                                    dc06e0bd632b791c57ee1a9a11220b1767bcd044

                                                    SHA256

                                                    43e138ec78259ad030f97263e3fd1b2212abb66fcdb7760f3515c60bb259df1b

                                                    SHA512

                                                    61b8d7d5a3af77c0e783e02ec51a27a7178a8009bd759f799add63df3abd4db419034cab0dc3f1d209a2badfb9f30d96ab3b78296b4c97146806ac911a6f6445

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences
                                                    Filesize

                                                    15KB

                                                    MD5

                                                    c91c3610cfd151bece42f7bc3d8d74ee

                                                    SHA1

                                                    faac694f213c09cba78bc319e2196bda290c9ab8

                                                    SHA256

                                                    68e1aa213d962064341c32b763bd6486bcfdac9d888a9f97f0564c5b0721bfcc

                                                    SHA512

                                                    f2c11cdfd30dcd8c2839fff2ddb217e573df82428bb8153dd82fcfbad5adead68df951fa7c60eea2d8537e147cd385c5f4bc0bdbe5d2a05594ab553f9640ca26

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Local State
                                                    Filesize

                                                    234KB

                                                    MD5

                                                    152e472b514936f0d1c8d778b8e5af03

                                                    SHA1

                                                    6147f303607f079511a3cdce0dc93a47c7ae69b7

                                                    SHA256

                                                    d00e5fb2a724d74eff04c1a30b18fe35595754cf4d7da621d5a5d16e0cb24dd4

                                                    SHA512

                                                    588a68e7d62c77ebf8f32f334c072ef453cd53ad8cef3f0a5b06ca82d3b6171a9aaedfb47bb41a3898605530fa4e911c8cd835b0cdcf6a3af06615b16bfd536e

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Google\Chrome\User Data\ShaderCache\data_1
                                                    Filesize

                                                    264KB

                                                    MD5

                                                    f50f89a0a91564d0b8a211f8921aa7de

                                                    SHA1

                                                    112403a17dd69d5b9018b8cede023cb3b54eab7d

                                                    SHA256

                                                    b1e963d702392fb7224786e7d56d43973e9b9efd1b89c17814d7c558ffc0cdec

                                                    SHA512

                                                    bf8cda48cf1ec4e73f0dd1d4fa5562af1836120214edb74957430cd3e4a2783e801fa3f4ed2afb375257caeed4abe958265237d6e0aacf35a9ede7a2e8898d58

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
                                                    Filesize

                                                    1KB

                                                    MD5

                                                    33b19d75aa77114216dbc23f43b195e3

                                                    SHA1

                                                    36a6c3975e619e0c5232aa4f5b7dc1fec9525535

                                                    SHA256

                                                    b23ced31b855e5a39c94afa1f9d55b023b8c40d4dc62143e0539c6916c12c9d2

                                                    SHA512

                                                    676fa2fd34878b75e5899197fe6826bb5604541aa468804bc9835bd3acabed2e6759878a8f1358955413818a51456816e90f149133828575a416c2a74fc7d821

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
                                                    Filesize

                                                    11KB

                                                    MD5

                                                    581564c75e513fd0536c72ce1b46ccde

                                                    SHA1

                                                    ee4381c8c112ac13e5c7c13c14a7eefb492d404f

                                                    SHA256

                                                    1c2b4c9c9e956d406fec097ac4af121e86d16fd432375ff197389fd2af6c809a

                                                    SHA512

                                                    0856361d74eedc6e48beff11e3d676845914489c3c882b977f5fe13f9fc59e2e8ef2139b8378644881d32de94acaa173e35f5325385d79b8a7e5f3a188505a4f

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_qt4znhva.vmt.ps1
                                                    Filesize

                                                    60B

                                                    MD5

                                                    d17fe0a3f47be24a6453e9ef58c94641

                                                    SHA1

                                                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                                                    SHA256

                                                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                                                    SHA512

                                                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsvB9BC.tmp\System.dll
                                                    Filesize

                                                    12KB

                                                    MD5

                                                    192639861e3dc2dc5c08bb8f8c7260d5

                                                    SHA1

                                                    58d30e460609e22fa0098bc27d928b689ef9af78

                                                    SHA256

                                                    23d618a0293c78ce00f7c6e6dd8b8923621da7dd1f63a070163ef4c0ec3033d6

                                                    SHA512

                                                    6e573d8b2ef6ed719e271fd0b2fd9cd451f61fc9a9459330108d6d7a65a0f64016303318cad787aa1d5334ba670d8f1c7c13074e1be550b4a316963ecc465cdc

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsvB9BC.tmp\modern-wizard.bmp
                                                    Filesize

                                                    51KB

                                                    MD5

                                                    7f8e1969b0874c8fb9ab44fc36575380

                                                    SHA1

                                                    3057c9ce90a23d29f7d0854472f9f44e87b0f09a

                                                    SHA256

                                                    076221b4527ff13c3e1557abbbd48b0cb8e5f7d724c6b9171c6aadadb80561dd

                                                    SHA512

                                                    7aa65cfadc2738c0186ef459d0f5f7f770ba0f6da4ccd55a2ceca23627b7f13ba258136bab88f4eee5d9bb70ed0e8eb8ba8e1874b0280d2b08b69fc9bdd81555

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsvB9BC.tmp\nsDialogs.dll
                                                    Filesize

                                                    9KB

                                                    MD5

                                                    b7d61f3f56abf7b7ff0d4e7da3ad783d

                                                    SHA1

                                                    15ab5219c0e77fd9652bc62ff390b8e6846c8e3e

                                                    SHA256

                                                    89a82c4849c21dfe765052681e1fad02d2d7b13c8b5075880c52423dca72a912

                                                    SHA512

                                                    6467c0de680fadb8078bdaa0d560d2b228f5a22d4d8358a1c7d564c6ebceface5d377b870eaf8985fbee727001da569867554154d568e3b37f674096bbafafb8

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Local\Temp\nsvB9BC.tmp\nsExec.dll
                                                    Filesize

                                                    7KB

                                                    MD5

                                                    11092c1d3fbb449a60695c44f9f3d183

                                                    SHA1

                                                    b89d614755f2e943df4d510d87a7fc1a3bcf5a33

                                                    SHA256

                                                    2cd3a2d4053954db1196e2526545c36dfc138c6de9b81f6264632f3132843c77

                                                    SHA512

                                                    c182e0a1f0044b67b4b9fb66cef9c4955629f6811d98bbffa99225b03c43c33b1e85cacabb39f2c45ead81cd85e98b201d5f9da4ee0038423b1ad947270c134a

                                                    Download Submit

                                                  • C:\Users\Admin\AppData\Roaming\o9xM6.bat
                                                    Filesize

                                                    392B

                                                    MD5

                                                    30d6eb22d6aeec10347239b17b023bf4

                                                    SHA1

                                                    e2a6f86d66c699f6e0ff1ac4e140af4a2a4637d1

                                                    SHA256

                                                    659df6b190a0b92fc34e3a4457b4a8d11a26a4caf55de64dfe79eb1276181f08

                                                    SHA512

                                                    500872c3f2f3f801ec51717690873194675cb7f32cc4a862c09d90c18638d364d49b0e04c32323f52734e5c806e3503a63ac755c7019d762786a72840123df76

                                                    Download Submit

                                                  • \??\c:\PROGRA~2\letsvpn\driver\tap0901.sys
                                                    Filesize

                                                    38KB

                                                    MD5

                                                    c10ccdec5d7af458e726a51bb3cdc732

                                                    SHA1

                                                    0553aab8c2106abb4120353360d747b0a2b4c94f

                                                    SHA256

                                                    589c5667b1602837205da8ea8e92fe13f8c36048b293df931c99b39641052253

                                                    SHA512

                                                    7437c12ae5b31e389de3053a55996e7a0d30689c6e0d10bde28f1fbf55cee42e65aa441b7b82448334e725c0899384dee2645ce5c311f3a3cfc68e42ad046981

                                                    Download Submit

                                                  • \??\c:\program files (x86)\letsvpn\driver\tap0901.cat
                                                    Filesize

                                                    10KB

                                                    MD5

                                                    f73ac62e8df97faf3fc8d83e7f71bf3f

                                                    SHA1

                                                    619a6e8f7a9803a4c71f73060649903606beaf4e

                                                    SHA256

                                                    cc74cdb88c198eb00aef4caa20bf1fda9256917713a916e6b94435cd4dcb7f7b

                                                    SHA512

                                                    f81f5757e0e449ad66a632299bcbe268ed02df61333a304dccafb76b2ad26baf1a09e7f837762ee4780afb47d90a09bf07cb5b8b519c6fb231b54fa4fbe17ffe

                                                    Download Submit

                                                  • memory/244-556-0x0000000006E20000-0x0000000006E2A000-memory.dmp

                                                    Filesize

                                                    40KB

                                                    Download

                                                  • memory/244-552-0x0000000005FD0000-0x0000000005FEE000-memory.dmp

                                                    Filesize

                                                    120KB

                                                    Download

                                                  • memory/244-553-0x0000000006CE0000-0x0000000006D83000-memory.dmp

                                                    Filesize

                                                    652KB

                                                    Download

                                                  • memory/244-554-0x0000000007410000-0x0000000007A8A000-memory.dmp

                                                    Filesize

                                                    6.5MB

                                                    Download

                                                  • memory/244-555-0x0000000006DD0000-0x0000000006DEA000-memory.dmp

                                                    Filesize

                                                    104KB

                                                    Download

                                                  • memory/244-542-0x000000006F730000-0x000000006F77C000-memory.dmp

                                                    Filesize

                                                    304KB

                                                    Download

                                                  • memory/244-557-0x0000000007050000-0x00000000070E6000-memory.dmp

                                                    Filesize

                                                    600KB

                                                    Download

                                                  • memory/244-558-0x0000000006FB0000-0x0000000006FC1000-memory.dmp

                                                    Filesize

                                                    68KB

                                                    Download

                                                  • memory/244-559-0x0000000006FE0000-0x0000000006FEE000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/244-560-0x0000000006FF0000-0x0000000007004000-memory.dmp

                                                    Filesize

                                                    80KB

                                                    Download

                                                  • memory/244-561-0x00000000070F0000-0x000000000710A000-memory.dmp

                                                    Filesize

                                                    104KB

                                                    Download

                                                  • memory/244-562-0x0000000007030000-0x0000000007038000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/244-541-0x0000000006010000-0x0000000006042000-memory.dmp

                                                    Filesize

                                                    200KB

                                                    Download

                                                  • memory/244-539-0x0000000006090000-0x00000000060DC000-memory.dmp

                                                    Filesize

                                                    304KB

                                                    Download

                                                  • memory/244-528-0x0000000005450000-0x00000000057A4000-memory.dmp

                                                    Filesize

                                                    3.3MB

                                                    Download

                                                  • memory/808-84-0x0000000003810000-0x0000000003879000-memory.dmp

                                                    Filesize

                                                    420KB

                                                    Download

                                                  • memory/808-83-0x0000000003810000-0x0000000003879000-memory.dmp

                                                    Filesize

                                                    420KB

                                                    Download

                                                  • memory/808-82-0x0000000003810000-0x0000000003879000-memory.dmp

                                                    Filesize

                                                    420KB

                                                    Download

                                                  • memory/808-81-0x0000000003810000-0x0000000003879000-memory.dmp

                                                    Filesize

                                                    420KB

                                                    Download

                                                  • memory/808-50-0x0000000003810000-0x0000000003879000-memory.dmp

                                                    Filesize

                                                    420KB

                                                    Download

                                                  • memory/808-31-0x0000000003810000-0x0000000003879000-memory.dmp

                                                    Filesize

                                                    420KB

                                                    Download

                                                  • memory/808-30-0x0000000003810000-0x0000000003879000-memory.dmp

                                                    Filesize

                                                    420KB

                                                    Download

                                                  • memory/808-29-0x0000000003810000-0x0000000003879000-memory.dmp

                                                    Filesize

                                                    420KB

                                                    Download

                                                  • memory/2220-698-0x0000000005B40000-0x0000000005B86000-memory.dmp

                                                    Filesize

                                                    280KB

                                                    Download

                                                  • memory/2220-757-0x0000000033F60000-0x0000000033F76000-memory.dmp

                                                    Filesize

                                                    88KB

                                                    Download

                                                  • memory/2220-817-0x000000006CE20000-0x000000006D888000-memory.dmp

                                                    Filesize

                                                    10.4MB

                                                    Download

                                                  • memory/2220-694-0x00000000031D0000-0x00000000031F4000-memory.dmp

                                                    Filesize

                                                    144KB

                                                    Download

                                                  • memory/2220-690-0x0000000000C60000-0x0000000000DE4000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/2220-707-0x0000000005DA0000-0x0000000005E52000-memory.dmp

                                                    Filesize

                                                    712KB

                                                    Download

                                                  • memory/2220-708-0x0000000005EC0000-0x0000000006214000-memory.dmp

                                                    Filesize

                                                    3.3MB

                                                    Download

                                                  • memory/2220-709-0x00000000069C0000-0x0000000006EEC000-memory.dmp

                                                    Filesize

                                                    5.2MB

                                                    Download

                                                  • memory/2220-710-0x00000000068A0000-0x00000000068C2000-memory.dmp

                                                    Filesize

                                                    136KB

                                                    Download

                                                  • memory/2220-816-0x000000006CE20000-0x000000006D888000-memory.dmp

                                                    Filesize

                                                    10.4MB

                                                    Download

                                                  • memory/2220-714-0x00000000068D0000-0x00000000068EE000-memory.dmp

                                                    Filesize

                                                    120KB

                                                    Download

                                                  • memory/2220-715-0x00000000068F0000-0x000000000690A000-memory.dmp

                                                    Filesize

                                                    104KB

                                                    Download

                                                  • memory/2220-812-0x000000006CE20000-0x000000006D888000-memory.dmp

                                                    Filesize

                                                    10.4MB

                                                    Download

                                                  • memory/2220-717-0x0000000006930000-0x000000000693A000-memory.dmp

                                                    Filesize

                                                    40KB

                                                    Download

                                                  • memory/2220-718-0x0000000006970000-0x0000000006996000-memory.dmp

                                                    Filesize

                                                    152KB

                                                    Download

                                                  • memory/2220-719-0x0000000006920000-0x0000000006928000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/2220-720-0x0000000006940000-0x000000000694A000-memory.dmp

                                                    Filesize

                                                    40KB

                                                    Download

                                                  • memory/2220-721-0x0000000006950000-0x000000000695A000-memory.dmp

                                                    Filesize

                                                    40KB

                                                    Download

                                                  • memory/2220-722-0x000000000FBF0000-0x000000000FBFA000-memory.dmp

                                                    Filesize

                                                    40KB

                                                    Download

                                                  • memory/2220-723-0x000000002FF20000-0x000000002FF46000-memory.dmp

                                                    Filesize

                                                    152KB

                                                    Download

                                                  • memory/2220-724-0x000000002FEE0000-0x000000002FEF0000-memory.dmp

                                                    Filesize

                                                    64KB

                                                    Download

                                                  • memory/2220-725-0x0000000031030000-0x00000000310C2000-memory.dmp

                                                    Filesize

                                                    584KB

                                                    Download

                                                  • memory/2220-730-0x0000000030880000-0x0000000030888000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/2220-731-0x00000000339D0000-0x0000000033A08000-memory.dmp

                                                    Filesize

                                                    224KB

                                                    Download

                                                  • memory/2220-732-0x0000000032F60000-0x0000000032F6E000-memory.dmp

                                                    Filesize

                                                    56KB

                                                    Download

                                                  • memory/2220-739-0x00000000340A0000-0x00000000340B2000-memory.dmp

                                                    Filesize

                                                    72KB

                                                    Download

                                                  • memory/2220-746-0x00000000346A0000-0x0000000034C44000-memory.dmp

                                                    Filesize

                                                    5.6MB

                                                    Download

                                                  • memory/2220-750-0x0000000032EF0000-0x0000000032F02000-memory.dmp

                                                    Filesize

                                                    72KB

                                                    Download

                                                  • memory/2220-749-0x0000000032EC0000-0x0000000032EC8000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/2220-751-0x0000000032F10000-0x0000000032F24000-memory.dmp

                                                    Filesize

                                                    80KB

                                                    Download

                                                  • memory/2220-752-0x0000000032F30000-0x0000000032F38000-memory.dmp

                                                    Filesize

                                                    32KB

                                                    Download

                                                  • memory/2220-753-0x00000000340C0000-0x00000000340DE000-memory.dmp

                                                    Filesize

                                                    120KB

                                                    Download

                                                  • memory/2220-756-0x0000000031440000-0x0000000031450000-memory.dmp

                                                    Filesize

                                                    64KB

                                                    Download

                                                  • memory/2220-702-0x0000000005AF0000-0x0000000005AFA000-memory.dmp

                                                    Filesize

                                                    40KB

                                                    Download

                                                  • memory/2220-758-0x0000000031450000-0x0000000031460000-memory.dmp

                                                    Filesize

                                                    64KB

                                                    Download

                                                  • memory/2220-768-0x00000000353B0000-0x00000000353FA000-memory.dmp

                                                    Filesize

                                                    296KB

                                                    Download

                                                  • memory/2220-769-0x0000000031110000-0x000000003115C000-memory.dmp

                                                    Filesize

                                                    304KB

                                                    Download

                                                  • memory/2220-779-0x0000000037480000-0x0000000037523000-memory.dmp

                                                    Filesize

                                                    652KB

                                                    Download

                                                  • memory/2220-780-0x0000000037800000-0x0000000037876000-memory.dmp

                                                    Filesize

                                                    472KB

                                                    Download

                                                  • memory/2220-781-0x0000000037550000-0x0000000037561000-memory.dmp

                                                    Filesize

                                                    68KB

                                                    Download

                                                  • memory/2220-782-0x000000006CE20000-0x000000006D888000-memory.dmp

                                                    Filesize

                                                    10.4MB

                                                    Download

                                                  • memory/2220-783-0x0000000038C60000-0x0000000038DE6000-memory.dmp

                                                    Filesize

                                                    1.5MB

                                                    Download

                                                  • memory/2220-786-0x0000000038DF0000-0x0000000038E38000-memory.dmp

                                                    Filesize

                                                    288KB

                                                    Download

                                                  • memory/2220-787-0x0000000038E90000-0x0000000038F12000-memory.dmp

                                                    Filesize

                                                    520KB

                                                    Download

                                                  • memory/2220-801-0x0000000034EE0000-0x0000000034F12000-memory.dmp

                                                    Filesize

                                                    200KB

                                                    Download

                                                  • memory/2220-806-0x000000006CE20000-0x000000006D888000-memory.dmp

                                                    Filesize

                                                    10.4MB

                                                    Download

                                                  • memory/2220-808-0x000000006CE20000-0x000000006D888000-memory.dmp

                                                    Filesize

                                                    10.4MB

                                                    Download

                                                  • memory/2220-809-0x000000006CE20000-0x000000006D888000-memory.dmp

                                                    Filesize

                                                    10.4MB

                                                    Download

                                                  • memory/2296-51-0x0000000005250000-0x0000000005286000-memory.dmp

                                                    Filesize

                                                    216KB

                                                    Download

                                                  • memory/2296-55-0x00000000061C0000-0x0000000006226000-memory.dmp

                                                    Filesize

                                                    408KB

                                                    Download

                                                  • memory/2296-66-0x0000000006810000-0x000000000682E000-memory.dmp

                                                    Filesize

                                                    120KB

                                                    Download

                                                  • memory/2296-65-0x0000000006230000-0x0000000006584000-memory.dmp

                                                    Filesize

                                                    3.3MB

                                                    Download

                                                  • memory/2296-52-0x00000000059F0000-0x0000000006018000-memory.dmp

                                                    Filesize

                                                    6.2MB

                                                    Download

                                                  • memory/2296-54-0x0000000006150000-0x00000000061B6000-memory.dmp

                                                    Filesize

                                                    408KB

                                                    Download

                                                  • memory/2296-53-0x0000000005970000-0x0000000005992000-memory.dmp

                                                    Filesize

                                                    136KB

                                                    Download

                                                  • memory/2296-67-0x0000000006840000-0x000000000688C000-memory.dmp

                                                    Filesize

                                                    304KB

                                                    Download

                                                  • memory/3212-1-0x0000000180000000-0x0000000180264000-memory.dmp

                                                    Filesize

                                                    2.4MB

                                                    Download

                                                  • memory/3212-4-0x0000000180000000-0x0000000180264000-memory.dmp

                                                    Filesize

                                                    2.4MB

                                                    Download

                                                  • memory/3212-19-0x0000000180000000-0x0000000180264000-memory.dmp

                                                    Filesize

                                                    2.4MB

                                                    Download

                                                  • memory/3212-3-0x0000000180000000-0x0000000180264000-memory.dmp

                                                    Filesize

                                                    2.4MB

                                                    Download

                                                  • memory/5000-965-0x000000006CE20000-0x000000006D888000-memory.dmp

                                                    Filesize

                                                    10.4MB

                                                    Download

                                                  • memory/5000-968-0x000000006CE20000-0x000000006D888000-memory.dmp

                                                    Filesize

                                                    10.4MB

                                                    Download

                                                  • memory/5000-969-0x000000006CE20000-0x000000006D888000-memory.dmp

                                                    Filesize

                                                    10.4MB

                                                    Download

                                                  • memory/5000-972-0x000000006CE20000-0x000000006D888000-memory.dmp

                                                    Filesize

                                                    10.4MB

                                                    Download

                                                  • memory/5000-981-0x000000006CE20000-0x000000006D888000-memory.dmp

                                                    Filesize

                                                    10.4MB

                                                    Download